Some of the signs your site has been hacked?

These are just a few of the signs that your site may be hacked and serving up unwanted content.

• Google Search is reporting search results that your site may harm your computer.
  
• Your main email account is getting bounce back messages with the subject line of “Subject: Mail delivery failed: returning message to sender” of spam content or emails not originating from you.
• Getting notices from your host that your site is sending unwanted messages and is currently suspended.
• You receive an email from a financial institution reporting that your website is serving up pages that are asking for personal information from people going to it.
• When you are browsing your site it redirects you to a unknown website that then has advertisements and/or attempts to install malware on your machine.
• Unwanted links within your site.

Scanning your site for a malware

There are tools out there like Sucuri that will do a scan of the front facing version of your site for vulnerabilities.

This type of scan will usually tell you what they have found that is causing your site to show that it is infected with malware.

Some source code that hackers use

Here are some examples of what you will find as code that has been inserted into your site.

Some of these are just a piece of the actual code that is either inserted into an existing file or the created a file with just their code in it.

No Shell Access

Another great tool is the Look-See Security Scanner. This is a plugin scans your system for files that have code matching known hacks or code injections.

It seams to do a pretty decent job as it even searches hidden directories and also checks permission levels. This can be resource heavy and may take a while to run. It also gives some false-positives but I would rather check a clean file than miss a hacked file.

WordPress FAQ for a hacked site

WordPress has a good resource, https://codex.wordpress.org/FAQ_My_site_was_hacked.

• Checking with your service provider to see if its just a service outage or is it truly a site hack.
• Create a backup of what you do have so you have a beginning point to work from
• Improve your access control by password updating and cookie resetting.

Sometimes it is the actual admin accounts and passwords that have been compromised. You should also update the SALT keys within your wp-config.php by generating new ones at, https://api.wordpress.org/secret-key/1.1/salt/ as well as changing your admin passwords.

• Do a scan of your Database through phpMyAdmin to see if you have any malicious code.

Initial steps to take when recovering

First step I usually do is download the version of WordPress that is currently installed, hopefully it is the current version. Then I replace all core files of a WordPress install. This includes the following files and directories.

• wp-admin/
• wp-includes/
• index.php
• wp-activate.php
• wp-blog-header.php
• wp-comments-post.php
• wp-config-sample.php
• wp-cron.php
• wp-links-opml.php
• wp-load.php
• wp-login.php
• wp-mail.php
• wp-settings.php
• wp-signup.php
• wp-trackback.php
• xmlrpc.php

If there are other files in the root folder with a .php extension except for the wp-config.php file I would recommend removing them as well unless you know what they are and what they are there for. The only customized files in WordPress should be within the wp-content directory which is where your plugins, themes, and uploaded media files are located.

Checking your blog for other files

Referencing the log file, you should go through the files that are questionable to see if they should be deleted or edited.

Here is an example of a file that someone uploaded and made it appear like it is a legit WordPress file. This file was not found using the eval search but instead I also searched for _POST to see what files were handling post variables.

This file was found in the root folder of a site and its syntax matches what you would normally see in a WordPress file. This shows how resourceful hackers are in trying to get it so their file is bypassed when trying to find their files. If they were able to get this file up onto your site it would then give them the ability to upload any file they want to your system.

Another example using stand alone theme file

Here is another example of a hackers file with that would be found with the find eval call

Keep in mind when looking at files that the dates modified is one thing to look at but as this can be manipulated it can't always be trusted in finding files that have been modified.

A decoded example

On the previous slide I shared this example.

Which when decoded is the following code being evaluated.

This code is saying if the posted password matches, then do a run the decoded code posted to the variable code. In essence giving them the capability to run any php code they send giving them complete access to your accounts files.

Creating BackUps

So there are many different ways for someone to create a backup of their site:

• ManageWP – which allows you to manage multiple WordPress installs from one location. They also allow you to create backups that can be stored off site and restored as well. For $1.50 or less per site it gives you a managing control panel that they keep updated so you don't have too.
• VaultPress – Automattic's answer to backing up your site. For $9 a month you can get daily backups for your site, spam protection, automated restores, and a 30 day archive of your site.
• Managing the backups yourself.
  • BackupBuddy, BackWPup, BackUpWordPress, WP-DB-Backup, Duplicator, Dropbox Backup & Restore.
• These ways that you can take control over your backups.
• CPanel: Most hosting provider's control panels also give you the control to create backups of your site for archiving.

Once you have a clean site

So once you have cleaned your entire site I would recommend doing the following:

• Make a new backup of your site giving you a clean restore point.
• If you have been marked as a hacked site in Google, go into Google's Webmasters Tools and request a malware review.
• Harden up your WordPress install to which there are plenty of resources online. Some of which may include:
  • Changing the default admin username and Changing the login URL..
  • Make sure you are using tough passwords not only in WordPress but your CPanel/FTP accounts.
• Stay up to date on your WordPress updates.
• Plugins like WordFence andSucuri are a couple of the plugins that can monitor your site for modifications.
• Do periodic scans of your account for hacks to be proactive. Either by the shell or Look-See are a couple good ways to do this. This way you can try to catch unkown hacks before they become an issue.
• Don't trust just one single product for protecting your system. Just like virus scanning software for your computer, one may be better in one area than another.
• If you are a developer make sure you code in best practices.

Contact Information

Greg Whitehead | [email protected]
Sr. Web Application Developer
inConcert Web Solutions | inconcertweb.com

Personal: wpcms.ninja | [email protected]
Twitter: @WPCMSNinja & @BilliardGreg (I am a pool player with a career problem)
Facebook: www.facebook.com/WPCMSNinja
LinkedIn: www.linkedin.com/in/gwhitehead
Github: github.com/WPCMSNinja